medium10 pts · first answer countsedrphishing-analysisalert-triage

Suspicious process tree in EDR

An EDR alert shows this process tree on a finance user laptop. What is the most likely explanation?

outlook.exe
  -> winword.exe  (Invoice_Oct.docm)
       -> powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBi...

A.A normal Microsoft Office update running in the backgroundB.The user ran a PowerShell script for a finance reportC.A malicious macro in an emailed document launched hidden, encoded PowerShell, likely to download a payloadD.Windows Defender scanning the attachment

Discussion 0

Join free to post in the discussion.

Suspicious process tree in EDR

Discussion 0

Related questions